From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Gomathivinayagam Muthuvinayagam <sankarmail@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: conntrack output - question
Date: Wed, 8 Aug 2012 16:12:47 +0200 [thread overview]
Message-ID: <20120808141247.GA1734@1984> (raw)
In-Reply-To: <CAAJpzgba1eL73KxNZWLU7DxJsrZitdb2WkUOe=An_J-Q677+sg@mail.gmail.com>
On Mon, Aug 06, 2012 at 10:38:03PM -0700, Gomathivinayagam Muthuvinayagam wrote:
> Conntrack classifies a packet to a flow based on protocol no, srcip,
> destip, srcport, and destport.
>
> A sample output is shown below,
>
> [NEW] udp 17 30 src=192.168.2.100 dst=192.168.2.1 sport=57767
> dport=53 [UNREPLIED] src=192.168.2.1 dst=192.168.2.100 sport=53
> dport=57767
>
> Here, what's the need of reply srcip, reply destip, reply srcport,
> reply destport? (Since we can imply these information from original
> srcp ip, original destip, original srcport, original destport)
> Is it just for avoiding for confusion, or anyother reasons behind this?
We need the reply tuple for NAT scenarios. In those cases, original
tuples does not match the reply tuple.
prev parent reply other threads:[~2012-08-08 14:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-07 5:38 conntrack output - question Gomathivinayagam Muthuvinayagam
2012-08-07 9:47 ` Eric Leblond
2012-08-08 14:12 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120808141247.GA1734@1984 \
--to=pablo@netfilter.org \
--cc=netfilter@vger.kernel.org \
--cc=sankarmail@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).